Privacy

PRIVACY POLICY

Version 1.7 — Last updated: 2026-09-17

1. INTRODUCTION

CaseMed Inc. (“CaseMed”, “we”, “us”, “our”) is a corporation incorporated under the laws of the Province of Nova Scotia, Canada. CaseMed operates an artificial intelligence (“AI”) voice-based clinical simulation platform used by health professionals and the organizations responsible for their training.

This Privacy Policy describes the personal information CaseMed collects, the purposes for which it is used, the parties to whom it may be disclosed, the periods for which it is retained, and the choices and rights available to individuals. It applies to the CaseMed website at https://casemed.app and its subdomains (the “Website”), the CaseMed platform (the “Platform”), and all related products and services (collectively, the “Services”).

This Policy is incorporated by reference into the CaseMed End User Licence Agreement (the “EULA”) and the CaseMed Services and Licensing Agreement (the “Services Agreement”), found at https://casemed.app/legal. Capitalized terms used but not defined in this Policy have the meanings given in Schedule A to the EULA; in this Policy "Client" includes both an Organization and an Individual Subscriber.

The Services are not intended for use by minors. CaseMed does not knowingly collect personal information from individuals below the age of majority in their jurisdiction.

1.1 Privacy Officer

CaseMed has designated a Privacy Officer, who is responsible for CaseMed’s compliance with this Policy and with applicable privacy legislation, and who may be contacted at privacy@casemed.app.

Privacy Officer CaseMed Inc. 600-1741 Lower Water Street, P.O. Box 997, Halifax, Nova Scotia B3J 0J2 privacy@casemed.app +1 902 702 3755

Enquiries, requests, and complaints concerning personal information may be directed to the Privacy Officer. CaseMed will acknowledge receipt within 5 business days and will respond within 30 days, or will advise of the reason additional time is required.

2. SCOPE

This Policy applies to personal information collected from all Visitors, including Clients, Account holders, and individuals who use the Website without holding an Account.

2.1 Visitors

A Visitor is any individual who accesses or uses the Website or the Services, regardless of whether they are a Client, hold an Account, or have made Payment.

2.2 Clients

A Client is the party that has purchased access to the Platform. A Client may be an Organization or an Individual Subscriber.

Organizations. Organizations purchase access to the Platform for one or more End Users. They include but are not limited to hospitals, colleges, universities, and other organizations purchasing access to the Platform on behalf of their own clients, students, employees, or other affiliated individuals who are the End Users of the Platform. An Organization is also allocated one or more Administrator Accounts for managing the End Users affiliated with it. An Organization is therefore typically a Client with several associated Accounts.

Individual Subscribers. Individual Subscribers purchase access to the Platform for their own use under Schedule B (Individual Subscriber Terms) to the EULA. An Individual Subscriber holds a single End User Account and manages their own subscription.

2.3 Accounts

Access to the Platform is exercised through the privileges accorded to an Account with valid status. An Account is either an Administrator Account or an End User Account.

Administrator. Administrator Accounts are held by representatives of an Organization Client and afford the privileges set out in the agreements signed with CaseMed. These Accounts are responsible for managing the Organization’s affiliated End Users and content.

End User. End User Accounts are held by individuals affiliated with an Organization Client, or by an Individual Subscriber, and afford the privileges set out in the agreements signed with CaseMed.

An Account is allocated to a single individual. Accounts may not be shared and may not be used by more than one individual in any circumstance; doing so invalidates the Account’s status.

Where an individual holds more than one Account, each Account — and the personal information and privileges associated with it — is treated separately.

2.4 Account status and Payment

Status. To validate an Account, the Account holder must declare their jurisdiction and age, accept the EULA during onboarding, and verify their email address. Until an Account has been validated, the individual may not use Platform features that require valid Account privileges.

Payment. Payment means consideration provided in exchange for some or all of the Services, including one-time payments, subscriptions, and other transfers of value, and is typically provisioned on an agreed basis through a valid Account. For the purposes of this Policy, a reference to Payment for Services means an agreement for Services that is currently in effect.

2.5 Application of this Policy regardless of status or Payment

This Policy applies to all Visitors, including those who request information from or otherwise contact CaseMed.

This Policy applies to Account holders whether or not the Account is valid, and whether or not Payment has been made for Services.

This Policy applies to individuals whose access to the Services has expired, lapsed, or been suspended or terminated.

This Policy continues to apply to personal information retained by CaseMed following the closure, suspension, or termination of an Account, for so long as that information is retained.

Account status and Payment determine what an individual may do on the Platform. They do not affect CaseMed’s obligations in respect of that individual’s personal information or the rights described in section 12.

2.6 Common arrangements and data visibility

The Visitor, Client, Account, status, and Payment definitions above determine whose personal information is visible to whom. Other privileges attaching to each type of Account are governed by the EULA and the Services Agreement rather than by this Policy, and are available at https://casemed.app/legal.

In this section, primary performance data means an End User’s own scores, rubric assessments, narrative feedback, and reports. Secondary performance data means aggregate or derived measures calculated across more than one End User, such as averages, distributions, and trends. Secondary performance data is made available only where it does not identify any individual End User.

The following are common arrangements arising from these definitions.

• 1.Client is an Organization; Account is an Administrator. A valid Administrator whose Organization has made Payment can view the primary performance data of End Users within their Organization and can contact those End Users through the Platform’s messaging system. Section 7.2 sets out what an Organization can see.
• 2.Client is an Organization; Account is an End User. A valid End User whose Organization has made Payment has primary performance data that is visible to the Administrators of their Organization. The End User cannot view the primary performance data of any other Account. Secondary performance data may be made available to them.
• 3.Client is an Individual Subscriber; Account is an End User. A valid End User who has made Payment can view their own primary performance data and reports. The Account is not associated with an Organization; no other Account has access to its primary performance data, and it has no access to the primary performance data of any other Account. Secondary performance data may be made available to them.
• 4.Account status is not valid; no Account; or Account closed, suspended, or terminated. Features requiring valid Account status are unavailable and no new performance data is generated. Privileges become available once the Account is validated.

2.7 Relationship to the agreements

The EULA and the Services Agreement govern access to and use of the Services, including the privileges accorded to each type of Account. This Policy governs CaseMed’s handling of personal information and prevails over those agreements to the extent of any inconsistency on that subject. Nothing in this Policy or in those agreements limits any right an individual has under applicable privacy legislation. The Data Processing Consent prevails over this Policy to the extent of any inconsistency on the subject of the personal information it covers.

3. INFORMATION COLLECTED

3.1 Account and registration information

• •Full legal name
• •Email address
• •Telephone number, where provided
• •Account credentials
• •Organization, role, program, and training level or year
• •Professional designation and specialty
• •Medical licence or college registration number, where continuing professional development (“CPD”) or continuing medical education (“CME”) credit is requested
• •Address, including country and province or state of residence, which determine the jurisdiction applied to the Account holder's rights and notices and the address to which notices are sent
• •Time zone and interface preferences

3.2 Voice and audio information

When the voice-based simulation features (the “Voice Features”) are used, CaseMed collects and processes:

• •audio recordings of the Account holder’s spoken input during simulated clinical encounters;
• •transcripts generated from those recordings; and
• •data derived from those recordings and transcripts.

The Voice Features cannot operate without capturing the Account holder's speech. Consent to audio recording is obtained through the Data Processing Consent (section 4); an Account holder who does not consent may sign in and use the non-voice features of the Platform.

3.3 Simulation, performance, and interaction information

• •Responses, questions, and clinical decisions expressed within a case
• •Investigations, imaging, and interventions selected within a case
• •Response times, navigation behaviour, and interaction patterns
• •Scores, rubric assessments, competency ratings, narrative feedback, and generated reports
• •Case assignments, attempts, completion status, and deadlines

Information in this section, together with the information described in section 3.2, constitutes “Platform Data” as that term is defined in the EULA and the Services Agreement.

3.4 Client Content

Administrators may upload the following on behalf of an Organization (together, "Client Content", as defined in the EULA and the Services Agreement):

• •Case Information — fictional or de-identified non-fictional medical and case information, and case templates; and
• •Assessment Materials — rubrics, scoring methods, objectives, and similar materials.

Under the Services Agreement, the Organization represents and warrants that all Client Content complies with applicable law; that any Client Content derived from real clinical encounters or patient records has been properly de-identified in accordance with applicable privacy and health-information legislation; and that all necessary consents, authorizations, and ethics approvals have been obtained.

CaseMed treats all Client Content as de-identified information. Separately, an Organization supplies CaseMed with Administrative Information: the names, email addresses, program, training level, and roster status of its End Users. Administrative Information is personal information, is not Client Content, and is handled in accordance with this Policy.

CaseMed handles Client Content in accordance with the safeguards described in section 10.

3.5 Payment and billing information

Payment card details are collected and processed by CaseMed’s payment processor. CaseMed does not receive or store full payment card numbers. CaseMed retains transaction records, the card brand and final four digits, billing name and address, and invoice history.

3.6 Technical and log information

• •IP address and derived approximate geographic region
• •Browser type and version, operating system, and device type
• •Audio device configuration
• •Pages and features accessed, timestamps, and referring URLs
• •Authentication events, session records, and security and audit logs
• •Error diagnostics and performance telemetry

3.7 Third-party information

The Platform presents simulated clinical scenarios only. No Account holder, Client, or other individual may speak, enter, or upload information identifying any other person, including but not limited to information identifying a real patient. Doing so is a violation of the agreements signed with CaseMed.

Where CaseMed becomes aware that information identifying another person has been submitted, CaseMed will isolate the affected record, remove the information from active systems, exclude it from any training corpus, record the matter in its incident register, and notify the Client and Account holder concerned so that they may meet any obligations of their own. CaseMed reserves the right to suspend an Account or terminate the Services where third-party information has been submitted, regardless of the reason for the submission. If CaseMed becomes aware that a recording contains the voice of a person other than the Account holder, it deletes that recording, audio and transcript, and excludes it from any training corpus.

4. VOICE AND BIOMETRIC INFORMATION

This section describes CaseMed's collection and use of voice information and, to the extent any information CaseMed processes is biometric information under applicable legislation, including the Illinois Biometric Information Privacy Act, 740 ILCS 14, constitutes CaseMed's notice for those purposes.

Information collected. Audio recordings of the Account holder’s speech during simulated clinical encounters, transcripts derived from those recordings, and data derived from those recordings and transcripts.

Purposes. The purposes stated in the Data Processing Consent: (1) delivery of the simulation; (2) generation and review of assessments; (3) quality assurance of CaseMed's assessment methods; (4) audit trail; (5) longitudinal assessment validity; (6) accreditation and audit defensibility; and (7) the training, fine-tuning, evaluation, and commercialization of CaseMed's AI models, including related research, publications, and marketing in which individuals are not identified. Purpose 7 applies only where the Account holder has chosen it in the Data Processing Consent. Purposes 3 to 6 use transcripts, Derived Data, and evaluative outputs, and not raw audio beyond the period needed to deliver and assess the case.

Consent. Consent to audio recording and to the purposes described above is obtained through the Data Processing Consent, presented separately during onboarding, after the EULA and before the first recorded session. Consent is required in order to use the Voice Features; an Account holder who does not consent may sign in and use the non-voice features of the Platform. Whether recordings are also used to train CaseMed's AI models is a separate choice made in the Data Processing Consent, which never affects access or assessment.

Length of term. Raw session audio is retained until the earlier of 12 months after expiry or termination of the subscription under which it was recorded, and 24 months after the Account holder last used the Services. That term applies where the Account holder has chosen model training, because successive model versions are trained and evaluated against the original audio. Where an Account holder has not chosen model training, or has withdrawn that choice, under section 5.5, their raw session audio is retained only for the period necessary to deliver and assess the case in which it was recorded.

CaseMed does not retain raw session audio beyond the applicable period. At the end of that period the audio is permanently deleted. Transcripts and Derived Data are retained for the periods set out in section 9.

Speaker representations. To run a session and, where the Account holder has chosen it, to train models, CaseMed's systems compute numerical representations of speech. Some may encode characteristics of the Account holder's voice and may be treated as a voiceprint or biometric identifier under the law of some jurisdictions. Each is computed only for the session or training run in which it arises, is never stored as a record of an individual or linked to an Account, and is destroyed when that session or run ends. Speaker representations are never retained as training data.

CaseMed does not:

• •use speaker representations, or any other voice data, to identify or verify the identity of any individual. Identity on the Platform is established by Account credentials;
• •maintain an enrolment database of speaker representations against which recordings are compared or matched;
• •retain a persistent speaker representation for an Account holder, whether within or across sessions;
• •use speaker representations to link an Account holder across separate sessions or Accounts;
• •use speaker representations or voice data to develop voice-cloning, voice-synthesis, or voice-impersonation products for commercial sale or licensing;
• •use voice data to generate synthetic audio misrepresenting an Account holder’s voice; or
• •make employment, credentialing, licensure, certification, or disciplinary determinations about an Account holder, or provide voice data to any person for that purpose, beyond the reporting to Organizations and accrediting bodies described in sections 7.2 and 7.3.

CaseMed’s AI models are not designed or used to reconstruct, reproduce, or identify the voice of any individual.

Model training outputs. Deletion of raw session audio does not reverse model training already carried out using that audio. Derived training outputs, including the parameters (weights) of CaseMed’s AI models, persist after the audio from which they were derived has been deleted. Those outputs are not a record of any individual and are not used to reconstruct or identify an Account holder’s voice. Section 12.2 sets out the effect of this on deletion requests.

Voice Biometrics under the agreements. "Voice Biometrics" means a voiceprint, speaker template, or other persistent representation that could identify an individual by voice, as defined in the EULA and the Services Agreement. CaseMed does not derive, retain, or hold Voice Biometrics and does not sell, licence, or transfer them to anyone. Disclosure of voice recordings to service providers and to parties engaged to support model development is described in sections 7.1 and 7.4.

Changes. CaseMed will not materially expand the purposes for which speaker representations or voice data are used without giving at least 30 days’ advance notice and, where the change would extend beyond what an Account holder has already consented to, obtaining fresh express consent.

5. PURPOSES FOR WHICH INFORMATION IS USED

CaseMed uses personal information for the following purposes.

5.1 Provision of the Services

• •Creating, administering, and authenticating Accounts
• •Delivering simulation sessions
• •Generating scores, feedback, and reports
• •Making results available to the End User and, where applicable, the Administrator of the End User’s Organization
• •Administering assignments, deadlines, and completions, and issuing related notifications
• •Providing technical support and responding to enquiries

5.2 Security and integrity

• •Detecting, investigating, and preventing unauthorized access, account sharing, fraud, and misuse
• •Maintaining audit logs and monitoring for security incidents
• •Enforcing the EULA, the Services Agreement, and this Policy
• •Comparing the country or region derived from the IP address at registration and at each session start with the declared jurisdiction, to determine where the Voice Features may lawfully be offered and to detect a false declaration; the comparison is kept in security logs for 12 months

5.3 Business operations

• •Processing payments, issuing invoices, and maintaining financial records
• •Reporting CPD and CME credit to accrediting bodies where credit has been requested
• •Meeting legal, tax, accounting, regulatory, and accreditation obligations

5.4 Product improvement and analytics

• •Diagnosing errors and monitoring performance, reliability, and availability
• •Analysing usage patterns to improve case design, assessment quality, and user experience

5.5 Research, development, and AI model training

CaseMed uses Platform Data, including audio recordings, transcripts, Derived Data, interaction data, and evaluative outputs, for the purposes stated in the Data Processing Consent and set out in section 4. The training, fine-tuning, evaluation, and commercialization of CaseMed's AI models, and related publications and marketing in which individuals are not identified, apply only where the Account holder has so chosen in the Data Processing Consent.

As set out in the EULA and the Services Agreement, CaseMed owns the Platform, its AI models, and all De-identified Data, aggregate data, and Derived Data that cannot identify an individual, and may use them for any lawful purpose. Platform Data that is personal information relating to an Account holder is not owned by CaseMed: CaseMed holds and uses it, under the licence granted in the EULA, only for the purposes and periods stated in this Policy and in that Account holder's Data Processing Consent. The model-training purpose applies only where the Account holder has chosen it in the Data Processing Consent.

Audio recorded during a session is used for these purposes for the period set out in section 9; where the Account holder has not chosen model training, or has withdrawn that choice, section 9 provides a shorter period.

Model-training choice. Whether an Account holder's recordings, transcripts, and Derived Data are used to train CaseMed's AI models is an express choice made in the Data Processing Consent and changeable at any time by written request to privacy@casemed.app identifying the Account, or when the Consent is re-affirmed. The choice takes effect on receipt: no training run started after CaseMed receives the request includes that Account holder's data. CaseMed acknowledges a request within five business days and, within 30 days, excludes the data from all future training runs and deletes raw audio already held rather than retaining it for the balance of the period in section 9; thereafter that Account holder's raw audio is retained only for the period necessary to deliver and assess each case. The choice does not affect access to the Platform or any assessment. It does not require the retraining of models developed before the request was received, and derived training outputs already produced are retained. Section 12.2 sets out the scope and limits of deletion and opt-out requests.

Where CaseMed publishes or presents research, the information used is aggregated, de-identified, or anonymized such that individuals are not identified.

5.6 Marketing communications

CaseMed sends marketing communications about its products, cases, and events only to individuals who have given express consent, for example by checking the marketing box at registration, which is unchecked by default. Each marketing message identifies CaseMed and includes an unsubscribe mechanism that takes effect within 10 business days. Administrative, service, and security notifications relating to an Account are not marketing communications and are sent for the duration of the Account. Where an Account is issued by an Organization, the End User also receives messages from that Organization’s Administrator through the Platform’s messaging system in connection with assignments, Account status, and related activities.

6. CONSENT

Consent is obtained during onboarding through three instruments:

• •the Services Agreement, accepted by the Client;
• •the EULA, accepted individually by each Account holder; and
• •the separate Data Processing Consent, presented to each Account holder after the EULA and before their first recorded session.

The Data Processing Consent sets out what is collected, the purposes for which it is used, the periods for which audio and other data are retained, that raw audio is permanently deleted at the end of that period, and the model-training choice described in section 5.5.

Where a seat has been purchased by an Organization, the End User accepts the EULA and the Data Processing Consent themselves. An Organization cannot give these consents on an End User’s behalf.

Re-confirmation. The Data Processing Consent is re-confirmed by the Account holder every twelve months, independently of any subscription, plan or payment. An Account holder who has not re-confirmed within 14 days of the date it falls due cannot start a new voice session until they do; signing in, viewing results, and the non-voice features of the Platform are unaffected, and consent to the retention and use of recordings already made continues for the term in section 9.

Where an Account is issued by an Organization, the Organization and its Administrator are responsible for authorizing access and for notifying End Users, before Accounts are activated, that they must accept the EULA and, before their first recorded session, the Data Processing Consent required to use the Voice Features.

Withdrawal. Consent to the Voice Features may be withdrawn at any time by written request to privacy@casemed.app; withdrawal stops recording, and no voice session can be started until consent is given again. Use of voice data for AI model training may be withdrawn separately, by changing the model-training choice under section 5.5. Withdrawal of consent to recording also ends any model-training permission and results in deletion of the raw audio CaseMed then holds; models already trained are not retrained or withdrawn, and transcripts, Derived Data, and evaluative outputs are retained as section 9 provides. Consent to marketing communications may be withdrawn at any time using the unsubscribe mechanism in any marketing message or by contacting the Privacy Officer. Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal, and does not extend to information CaseMed is required or permitted to retain under section 9 or applicable law.

7. DISCLOSURE OF PERSONAL INFORMATION

CaseMed does not disclose personal information for advertising purposes and does not disclose personal information to data brokers or advertising networks. Personal information may be disclosed in the following circumstances.

7.1 Service providers and processors

CaseMed engages service providers to perform functions on its behalf. These providers are bound by contract to process personal information only on CaseMed’s instructions and to maintain appropriate confidentiality and security safeguards.

CaseMed maintains a current list of service providers, available on request.

Certain processing is performed by CaseMed on its own infrastructure and does not involve disclosure to a third party.

7.2 Organizations

Where an Account has been issued by an Organization, that Organization’s Administrators may access:

• •the End User’s name, email address, program, and training level;
• •cases assigned and the status, date, and number of attempts;
• •scores, rubric assessments, competency ratings, and feedback reports;
• •Session transcripts, unless the Organization has disabled transcript access; and
• •cohort-level analytics that may include the End User’s results.

Administrators do not have access to raw session audio.

Administrators may also contact End Users within their Organization through the Platform’s messaging system in connection with assignments, Account status, and related activities.

An Organization’s use of this information is governed by its own policies and by its Services Agreement with CaseMed.

Where the Client is an Individual Subscriber, no Administrator or other Account has access to that Account's performance data.

7.3 Accrediting and credentialing bodies

Where an Account holder requests CPD or CME credit, CaseMed submits to the relevant accrediting body the information required for the award of credit, which typically comprises the Account holder’s name, licence or member number, the activity completed, the date of completion, and the credits earned. Participation is reported only where credit has been requested.

7.4 Research and model development partners

CaseMed may disclose Platform Data, including audio recordings, transcripts, and Derived Data, to third parties engaged by CaseMed to support model development, fine-tuning, evaluation, annotation, or related research. Such disclosure is made only in respect of Account holders who have chosen model training in the Data Processing Consent. Such parties act only as CaseMed's processors, on CaseMed's written instructions, are bound by contract to confidentiality and security obligations, and may not use the information for their own purposes. No Voice Biometrics are disclosed, because CaseMed creates none (section 4).

7.5 Legal and protective disclosures

CaseMed may disclose personal information where required or permitted by law, including in response to a court order, subpoena, warrant, or other lawful demand; to enforce its agreements; to investigate suspected fraud, misuse, or a security incident; or to protect the rights, property, or safety of any person.

7.6 Corporate transactions

In connection with a merger, acquisition, financing, reorganization, or sale of all or part of its business or assets, CaseMed may transfer personal information to the counterparty or its advisors, subject to appropriate confidentiality protections. The successor is bound by this Policy and by each Account holder's Data Processing Consent; any change is made only as section 14 and the Data Processing Consent provide.

8. INTERNATIONAL TRANSFER AND STORAGE

CaseMed is a Canadian corporation. Personal information collected through the Services, including audio recordings, transcripts, and performance data, is stored and processed on servers located in the United States and operated by the service providers identified in section 7.1. Under specific circumstances where a Services Agreement stipulates regional data processing and storage, the data will be handled and processed in the regions stipulated in that agreement.

While personal information is located in the United States, it is subject to the laws of that jurisdiction and may be accessible to United States courts, law enforcement agencies, regulators, and national security authorities in accordance with those laws. Those laws may differ from the laws of Canada or of an individual’s province, state, or country of residence.

CaseMed remains accountable for personal information transferred to a third party for processing and uses contractual and technical measures, including written data protection terms, encryption in transit and at rest, and access controls, to provide a comparable level of protection.

Before personal information relating to residents of Québec is communicated outside Québec, CaseMed conducts and documents a privacy impact assessment in accordance with section 17 of the Act respecting the protection of personal information in the private sector, and the transfer is governed by a written agreement reflecting that assessment.

Certain Organizations, including public bodies in Nova Scotia and British Columbia, are subject to requirements that personal information be stored and accessed only in Canada. Regional hosting may be available under a Services Agreement. Organizations subject to a data residency requirement should contact CaseMed prior to entering into a Services Agreement.

9. RETENTION

CaseMed retains personal information for the periods set out below, or for such longer period as is required by law.

Voice audio. Raw session audio is retained until the earlier of:

• •12 months after expiry or termination of the subscription under which it was recorded; and
• •24 months after the Account holder last used the Services.

Subscriptions renew automatically in accordance with the applicable agreement, and consent to the processing described in section 4 is re-confirmed as section 6 provides. Where an Account holder has chosen not to permit model training, or has withdrawn that permission, their raw session audio is retained only for the period necessary to deliver and assess the case in which it was recorded, and the choice is applied to audio already held.

At the end of the applicable period the raw audio, including copies in routine backups (which expire within 35 days), is permanently deleted. The same period applies in every jurisdiction; where the law of an Account holder’s jurisdiction requires a shorter period, that shorter period applies. As set out in section 4, deletion of raw audio does not reverse model training already carried out using it, and derived training outputs persist.

Transcripts, Derived Data, and evaluative outputs. Transcripts, Derived Data, interaction data, and scores, rubric assessments, and reports are retained in identifiable form for 36 months after the Account holder last used the Services or, where CPD or CME credit has been claimed, for 6 years from the date of the session, whichever is later, subject to any shorter period required by the law of the Account holder's jurisdiction; they are then de-identified and retained for the purposes in section 5, or deleted. Where the Account was issued by a United States educational institution that elects deletion of its education records when its agreement with CaseMed ends, these records are deleted with them (De-identified Data excepted); raw audio follows the period above.

Derived measures. Measures computed from session audio that cannot be used to reconstruct the audio and are not capable of distinguishing one speaker from another are retained indefinitely where they have been anonymized such that no individual can be identified, directly or indirectly.

Client Content. Where a Services Agreement expires or is terminated, the Client may elect within 30 days to have Client Content returned in a commercially reasonable format or deleted from CaseMed’s active production systems. Copies residing in routine backup systems are deleted as those backups expire in the ordinary course, currently within 35 days.

Other categories.

Information that has been aggregated or anonymized such that no individual can be identified, directly or indirectly, is not personal information and may be retained indefinitely.

10. SECURITY

10.1 Safeguards

CaseMed maintains administrative, technical, and physical safeguards designed to protect personal information against loss and unauthorized access, use, disclosure, alteration, or destruction. These include:

• •Encryption of personal information in transit and at rest
• •Role-based access controls, with access limited to personnel whose role requires it
• •Multi-factor authentication for administrative access
• •Audit logging of access to Accounts, session data, and Client Content
• •Network and system access controls
• •Periodic security reviews and vulnerability management
• •Documented incident detection and response procedures
• •Confidentiality obligations and privacy and security training for personnel and contractors

No method of transmission or storage is entirely secure, and CaseMed does not warrant that personal information will not be subject to unauthorized access.

10.2 Certification status

CaseMed is building its control environment against the AICPA Trust Services Criteria for Security, Availability, and Confidentiality. CaseMed does not currently hold a SOC 2 report. If and when a report is issued, it will be made available to Clients and prospective Clients under a non-disclosure agreement and this section will be updated.

10.3 Incident notification

Where a confidentiality or security incident creates a real risk of significant harm, or a risk of serious injury under applicable Québec legislation, CaseMed will notify affected individuals and the Office of the Privacy Commissioner of Canada and, in respect of Québec residents, the Commission d’accès à l’information du Québec, as soon as feasible, and will notify affected Clients in accordance with their Services Agreements. CaseMed maintains a register of confidentiality incidents whether or not notification is required.

11. AUTOMATED PROCESSING AND ASSESSMENT

Scores, competency ratings, and feedback reports generated by the Platform are produced by automated systems, using the Account holder's session information and the case's assessment criteria, except where those criteria are supplied by an Organization, in which case they are subject to that Organization's own processes.

Assessment is based on the Account holder’s clinical performance and communication within the case. An Account holder may request information regarding the personal information used to produce a particular assessment by contacting CaseMed. CaseMed informs the Account holder that a score was produced by automated processing. On request, CaseMed will inform the Account holder of the personal information used to produce the assessment and of the reasons and principal factors and parameters that led to it, and will correct inaccurate personal information. An Account holder may submit observations to a member of CaseMed's personnel who is able to review the assessment, by writing to privacy@casemed.app; CaseMed responds within 30 days.

Automated systems are subject to error, and performance may vary across accents, dialects, speech patterns, and first languages. CaseMed cannot guarantee deterministic outcomes for AI-generated responses under real use conditions at all times.

As stated in the EULA and the Services Agreement, the Services are intended for educational and professional development purposes. Assessments generated by the Platform do not constitute medical advice. Where an activity is specifically identified as accredited, completion may be reported for continuing professional development or continuing medical education credit as described in section 7.3. Except where an activity is so identified, assessments generated by the Platform are not a licensure, credentialing, certification, or fitness-to-practise determination.

Enquiries regarding an assessment, and requests to access or correct personal information used in an assessment, may be directed to CaseMed at https://casemed.app/contact or to the Privacy Officer.

12. ACCESS, CORRECTION, AND OTHER RIGHTS

12.1 General

Subject to applicable law, an individual may:

• •request access to the personal information CaseMed holds about them, and information regarding its use and disclosure;
• •request correction of personal information that is inaccurate or incomplete;
• •withdraw consent, as described in section 6; and
• •request deletion of personal information, which CaseMed will action except where retention is required or permitted under section 9, the EULA, the Services Agreement, or applicable law. Section 12.2 sets out what a deletion request covers and what it does not.

Requests should be directed to the Privacy Officer. CaseMed may require verification of identity before acting on a request. CaseMed does not charge a fee for access requests.

12.2 Scope and limits of deletion requests

A request for deletion is actioned against the personal information CaseMed holds at the time the request is received. It extends to:

• •raw session audio still within the retention period set out in section 9;
• •transcripts, Derived Data, interaction data, and evaluative outputs;
• •Account and profile information; and
• •Administrative Information relating to the individual,

except where CaseMed is required or permitted by law, or by section 9, to retain the information.

A request for deletion does not extend to:

• •information that has already been deleted in the ordinary course under section 9. Raw session audio in particular is deleted on the schedule in section 9 and is not held indefinitely;
• •derived training outputs, including the parameters (weights) of AI models trained before the request is actioned. As described in section 4, those parameters are not a record of any individual, are not attributable to any single Account holder, and are not used to reconstruct or identify any individual’s voice; or
• •aggregated, de-identified, or anonymized information that can no longer be attributed to an individual.

CaseMed does not retrain, roll back, or withdraw an AI model, or delete a model’s parameters, in response to a deletion request or an opt-out under section 5.5. Deletion and opt-out operate prospectively from the date the request is actioned.

CaseMed’s AI models are developed incrementally, each version building on versions that preceded it. The influence of data used in earlier training cannot be isolated within, or removed from, later versions. Exclusion under section 5.5 therefore applies to training carried out after a request is actioned, and does not reverse the effect of training already completed.

Nothing in this section limits a right that applicable privacy legislation confers on an individual and that cannot be limited by agreement.

12.3 Québec residents

In addition to section 12.1, residents of Québec may request that computerized personal information they have provided to CaseMed be communicated to them, or to a designated third party, in a structured, commonly used technological format. This right applies to information collected from the individual and does not extend to information created or inferred by CaseMed, including assessments and evaluative outputs. Residents of Québec may also exercise the rights provided under section 28.1 of the Act respecting the protection of personal information in the private sector.

12.4 United States residents

Residents of states with biometric privacy legislation, including Illinois, Texas, Colorado, and Washington, are entitled to the notice and consent described in section 4 and may contact the Privacy Officer regarding the personal information CaseMed holds. Residents of Washington may request confirmation as to whether CaseMed collects or shares consumer health data, and may request deletion of such data.

The rights described in section 12.1 are available to all Account holders and are exercised by contacting the Privacy Officer. Where an Account was issued by an Organization, CaseMed may coordinate its response with the Organization and responds within 30 days; section 12.5 applies to students of United States educational institutions. Nothing in this section limits any right an individual has under applicable privacy legislation.

12.5 Students of United States educational institutions

Where an Organization is a United States educational institution and CaseMed maintains education records on its behalf, CaseMed acts as a school official with a legitimate educational interest under the Family Educational Rights and Privacy Act, 34 CFR §99.31(a)(1)(i)(B), under the direct control of that Organization with respect to the use and maintenance of those records and subject to the redisclosure limitations of 34 CFR §99.33(a). Rights of access and correction under that Act are exercised through the Organization.

12.6 Complaints

Complaints should first be directed to the Privacy Officer. An individual who is not satisfied with CaseMed's response may contact the privacy regulatory authority of their province, state, or country of residence.

13. COOKIES AND SIMILAR TECHNOLOGIES

CaseMed uses cookies and similar technologies for the following purposes:

• •Strictly necessary — authentication, session management, security, and load balancing. These are required for the Platform to function.
• •Functional — retaining user preferences, including language and interface settings.
• •Analytics — CaseMed does not use third-party analytics, advertising, or session-replay technologies.

Cookies may be managed through browser settings. Disabling strictly necessary cookies will prevent sign-in.

14. AMENDMENTS

CaseMed may amend this Policy from time to time. The revised Policy will be posted at https://casemed.app/privacy with an updated "Last updated" date and will take effect upon posting. Where an amendment is material, CaseMed will provide notice by email or by other means it considers appropriate given the nature of the change; where an amendment would expand the purposes for which voice data is used or extend a retention period, it takes effect for an Account holder only on their fresh consent through the Data Processing Consent. Continued use of the Services following notice constitutes acceptance of the amended Policy.

15. CONTACT

CaseMed Inc. 600-1741 Lower Water Street, P.O. Box 997, Halifax, Nova Scotia B3J 0J2 privacy@casemed.app +1 902 702 3755

CaseMed has designated a Privacy Officer, who may be contacted at privacy@casemed.app.

General enquiries may be directed to CaseMed at https://casemed.app/contact.

This Policy should be read together with the CaseMed End User Licence Agreement and the CaseMed Services and Licensing Agreement.